Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

Description

References

• nvd.nist.gov/vuln/detail/CVE-2012-0818 · ADVISORY
• resteasy/resteasy commit 71ace87 · WEB
• web.archive.org/web/20200229045254/https://www.securityfocus.com/bid/51766 · WEB
• web.archive.org/web/20200229044434/http://www.securityfocus.com/bid/51748 · WEB
• issues.jboss.org/browse/RESTEASY-637 · WEB
• resteasy/Resteasy · PACKAGE
• exchange.xforce.ibmcloud.com/vulnerabilities/72808 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• access.redhat.com/security/cve/CVE-2012-0818 · WEB
• access.redhat.com/errata/RHSA-2014:0372 · WEB
• access.redhat.com/errata/RHSA-2014:0371 · WEB
• access.redhat.com/errata/RHSA-2013:1263

Mais vulnerabilidades de org.jboss.resteasy:resteasy-client

• CVE-2020-25633MÉDIO 5.3A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentia…
• CVE-2020-1695ALTO 7.5A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an imprope…
• CVE-2016-6347MÉDIO 6.1Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script…
• CVE-2016-6348MÉDIO 6.1JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
• CVE-2016-6345MÉDIO 6.5RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.